Roles & Permissions

A role is a named set of permissions. Every agent is assigned one or more roles, and the agent’s effective access is the union of the permissions across those roles. Roles are managed under Admin → Teammates → Roles.

Default roles

libredesk ships with two roles. Neither can be deleted.

Role	Description
`Admin`	Every permission except `messages:write_as_contact`, including all settings. This role cannot be edited. Create a new role if you need a variation.
`Agent`	Read, assign, and update conversations, send replies and private notes, and manage their own views.

The Admin role is locked and cannot be modified. To grant a subset of admin access, create a new role with only the permissions you need.

Permissions

Permissions follow an object:action format (for example roles:manage). The sections below list every available permission and what it grants.

Conversation

Permission	What it grants
`conversations:read`	Open and read an individual conversation, including its participants and search. Required to view any conversation.
`conversations:write`	Start new conversations.
`conversations:read_assigned`	List the conversations assigned to the agent.
`conversations:read_all`	List every conversation in the helpdesk, regardless of who it is assigned to.
`conversations:read_unassigned`	List conversations that are not yet assigned to anyone.
`conversations:read_team_inbox`	List the unassigned conversations in the inboxes of the agent’s teams.
`conversations:read_team_all`	List all conversations assigned to the agent’s teams.
`conversations:update_user_assignee`	Assign a conversation to an agent, or remove that assignment.
`conversations:update_team_assignee`	Assign a conversation to a team, or remove that assignment.
`conversations:update_priority`	Set a conversation’s priority.
`conversations:update_status`	Change a conversation’s status (for example open, resolved, or snoozed).
`conversations:update_tags`	Add or remove tags on a conversation.
`messages:read`	Read the messages in a conversation and download transcripts.
`messages:write`	Send replies to the contact in a conversation.
`messages:write_private`	Add private notes to a conversation, delete private notes, and post an AI summary as a private note. Agents can delete only their own notes. Members of the `Admin` role can delete any note.
`messages:write_as_contact`	Post a message into a conversation on the contact’s behalf.
`view:manage`	Create and manage the agent’s own saved conversation views (filters).

To open a conversation, an agent needs conversations:read plus a list permission that matches how the conversation is assigned. For example, conversations:read_assigned covers conversations assigned to the agent, and conversations:read_team_inbox covers team conversations with no agent assigned. Applying a macro needs the permission for each action in it. For example, a macro that sets tags needs conversations:update_tags. Before v2.9.0, messages:write also covered private notes. The v2.9.0 upgrade adds messages:write_private to every role that has messages:write.

Admin

Permission	What it grants
`general_settings:manage`	Edit instance-wide settings such as business name, branding, and defaults.
`notification_settings:manage`	Configure the email notifications that agents receive.
`status:manage`	Create, rename, and delete conversation statuses.
`oidc:manage`	Add and edit SSO (OpenID Connect) login providers.
`tags:manage`	Create, edit, delete, and import tags.
`macros:manage`	Create and edit macros (reusable sets of replies and actions).
`users:manage`	Create, edit, and delete agents, and assign their roles. See the warning below.
`teams:manage`	Create and edit teams and their membership.
`automations:manage`	Create and edit automation rules that act on conversations.
`inboxes:manage`	Create, configure, and delete inboxes (email, live chat, WhatsApp), including their channel connections, email alias verification, live chat proactive messages, and WhatsApp templates.
`roles:manage`	Create, edit, and delete roles and the permissions they grant.
`templates:manage`	Create and edit email templates.
`reports:manage`	View the reporting dashboards (overview, CSAT, SLA, message volume, tag distribution).
`business_hours:manage`	Define business-hour schedules and holidays used by SLAs.
`sla:manage`	Create and edit SLA policies.
`ai:manage`	Configure AI providers, editor prompts, snippets, FAQ suggestions, tools, and assistants.
`help_center:manage`	Create and edit help centers, collections, and articles, and view help center search insights.
`custom_attributes:manage`	Create and edit custom fields for conversations and contacts.
`activity_logs:manage`	View the activity (audit) log.
`webhooks:manage`	Create and edit outgoing webhooks.
`shared_views:manage`	Create and manage saved views shared with other agents.
`context_links:manage`	Configure the context links shown alongside a conversation.

users:manage is effectively full access. It lets an agent assign any role, including Admin, to any agent, themselves included. So anyone with users:manage can grant themselves every other permission. Treat it as equivalent to admin access and give it only to people you fully trust.

Contact

Permission	What it grants
`contacts:read_all`	List and view every contact.
`contacts:read`	View an individual contact’s profile and search contacts.
`contacts:write`	Edit a contact’s details.
`contacts:block`	Block or unblock contacts.
`contacts:delete`	Delete a contact.
`contacts:export`	Download all data stored for a contact as a JSON file.
`contact_notes:read`	Read the private notes on a contact.
`contact_notes:write`	Add private notes to a contact.
`contact_notes:delete`	Delete private notes on a contact.

Creating a role

Open roles

Go to Admin → Teammates → Roles and click New role.

Name the role

Give it a name and an optional description.

Select permissions

Check the permissions to grant. Anything left unchecked is denied.

Assign to agents

Save the role, then assign it to agents under Admin → Teammates → Agents. An agent’s access is the combined permissions of all roles assigned to them.

Introduction

Getting Started

Configuration

Roles

Contributing

Default roles

Permissions

Conversation

Admin

Contact

Creating a role

​Default roles

​Permissions

​Conversation

​Admin

​Contact

​Creating a role

Default roles

Permissions

Conversation

Admin

Contact

Creating a role